Slashdot Mirror
Not Just a Cleanup Any More: LibreSSL Project Announced
An anonymous reader writes "As some of you may know, the OpenBSD team has started cleaning up the OpenSSL code base. LibreSSL is primarily developed by the OpenBSD Project, and its first inclusion into an operating system will be in OpenBSD 5.6. In the wake of Heartbleed, the OpenBSD group is creating a simpler, cleaner version of the dominant OpenSSL. Theo de Raadt, founder and leader of OpenBSD and OpenSSH, tells ZDNet that the project has already removed 90,000 lines of C code and 150,000 lines of content. The project further promises multi-OS support once they have proper funding and the right portability team in place. Please consider donating to support LibreSSL via the OpenBSD foundation."
LibreSSL.... Please for the love of code, change the name!
'Nuff said
I look forward to new and interesting side-effects of the pell-mell rush to clean up the code of a poorly written, poorly maintained, and even more poorly documented software package!
you use polarssl. Which is already exactly that.
Religion is what happens when nature strikes and groupthink goes wrong.
They never claimed they were.
---- MISSING MISCELLANEOUS DATA SEGMENT --- [sigdash] trolololol
There's something at the bottom of the page.
"This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags"
This. Seriously. People may not think that appearance is important, but it is. Comic Sans does not inspire confidence.
Koans and fables for the software engineer
It put ME in a better mood and so I donated even more. I'd say it's genius!
CAPTCHA: patrons
finds out openssl is bollocks,
radically refactors and overhauls millions of lines of code.
as for the LibreSSL team, might i suggest some music?
http://www.openbsd.org/lyrics....
http://www.openbsd.org/lyrics....
Good people go to bed earlier.
Who thinks it's important? Who'll decide to switch or not based on a font on a website? Why?
I'd say it's puerile -- and a bit alarming, considering these people are building something so important to the continued health of the internet.
They DO OpenSSH. And other projects: http://www.openbsdfoundation.org/
Another problem with OpenSSL is its hideous API - huge, inconsistent, poorly documented, and exposing way too many low level protocol details that should be handled internally by the library, not by applications.
Comic Sans.
That looks professional.
"This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags"
Har har...
This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags.
Now if only libressl could have a sane licence that wasn't GPL-incompatible :(
Don't fork SSL, we need to keep one standard, I'd think. This is a bad idea. These resources could be used to improve OpenSSL directly.
Granted, the OBSD team has a known personality.
That said, diffs to remove compatibility would likely be rejected. Also, the rate at which they're being submitted wouldn't be verifiable by the OpenSSL team.
Plus, it's better to have multiple libraries.
This is for the better.
If You want a confidence audit the code.
Typefaces by their nature are designed to convey a specific emotions. It's the whole reason we don't simply convey written information in one fixed typeface; some are more appropriate than others given the situation.
Comic Sans in particular is designed to imitate comic book lettering. It's not particularly professional. In the wake of the OpenSSL bug, many people were questioning open source in general, saying (not rightfully, but saying nonetheless) that the Heartbleed bug was caused by a bunch of amateur volunteers. i.e. open source is not developed by professionals. Comic Sans doesn't exactly inspire confidence for people who now view the open source development model as dubious.
Comic Sans doesn't exactly inspire confidence for people who now view the open source development model as dubious.
Maybe in 2000, I would have cared but no longer. OSS is very well established and is in plenty of cases the leading option. If people want to make stupid emotional decisions, then it's time to let them. No actually, it's time to encourage them because it means I will have fewer serious competitors of the competition hamstring themselves with ill-informed emotional decisions.
SJW n. One who posts facts.
The key reason OpenSSL is so popular in US is because the project is on top of FIPS certifications. LibreSSL might cure cancer, but very few system integrators will use it unless it has certified module.
In the wake of the OpenSSL bug, many people were questioning open source in general, saying (not rightfully, but saying nonetheless) that the Heartbleed bug was caused by a bunch of amateur volunteers. i.e. open source is not developed by professionals
Except you're right, it was caused by half-assing what was supposed to be a good feature, because the programmers decided they would just stop and come back to it later. But now we have *different* amateur volunteers working on it! Problem solved!
Comic Sans doesn't exactly inspire confidence for people who now view the open source development model as dubious.
Maybe in 2000, I would have cared but no longer. OSS is very well established and is in plenty of cases the leading option. If people want to make stupid emotional decisions, then it's time to let them. No actually, it's time to encourage them because it means I will have fewer serious competitors of the competition hamstring themselves with ill-informed emotional decisions.
They're pleading for donations. Are you comfortable being the sole donor, too?
wow, thought you were kidding.
LibreSSL.... Please for the love of code, change the name!
I wish they would start a naming contest soon.
There ought to be _someone_ out there who can come up with some much better name than "LibreSSL" ...
Muchas Gracias, Señor Edward Snowden !
I'd say it's puerile -- and a bit alarming, considering these people are building something so important to the continued health of the internet.
But it goes right along with the notion that they are not even considering helping the original OpenSSL project (one that they have benefited greatly from in the past) and instead simply forked it in order to do only work that benefits themselves. The "we will get around to multiplatform when the donations pour in" is about as pathetic as the "we will get around to fixing that vulnerability countermeasure code later" that caused Heartbleed in the first place. If Heartbleed didn't scare people away from Free/Open Source software, then this surely will. Mission accomplished, Theo!
Ahem. You say "holding OpenSSL hostage," when in fact the two developers of OpenSSL are completely incomptent and deserve to have the project forcefully taken out of their hands.
OpenSSH is written in C, but I guess that's too complex for you. It is considered, by many held in high regards, to be "beautiful" code.
Now *there's* one that needs a cut-the-fat do-over.
Notice that Theo doesn't have the goal of making LibreSSL BSD-only.
At the moment we are too busy deleting and rewriting code to make a decent web page. No we don't want help making web pages, thank you.
Good marketing is what separates open-source software from the closed-source, shrink wrap sector.
Footer : "This page scientifically designed to annoy web hipsters. Donate now to stop the Comic Sans and Blink Tags"
And your post goes right along with the notion that Slashdot is filled with shitheads.
It's not about a better OpenSSL. It's about OpenBSD waving its penis around. That's all it is. The OpenSSL team is amenable to aid; but they have two developers and no help.
Well perhaps the OpenSSL folks need to examine how they're organized then.
There are reports that the OpenSSL Foundation got $2 000 for all of 2013. Meanwhile the FreeBSD Foundation got $750 000 in 2013, and are aiming for $1 million in 2014. The OpenBSD Foundation's goal for 2014 was $150K, which they reached.
I'm sure given OpenSSL's importance that they could match (and probably exceed) these other two projects, and get a proper staff.
How about going retro with iSSL or eSSL? Or maybe xSSL - X's are always cool.
You honestly think there will only be one donor to the OpenBSD project? The fuck
Congratulations, you are officially a web hipster.
Yes, they goofed. However, is anyone else volunteering their time for a project that at best is an entry on a resume? The OpenSSL coders are paying a dear opportunity cost for doing their work. they could easily be making far more per month by making another F2P/P2W app for iOS.
IMHO, if one thinks they can do better, then go for it. It is easy to be an armchair coder and tsk-tsk about other people's mistakes. It is a lot harder to be actually producing and debugging hundreds of thousands of lines of code... earning zero for the task.
After stripping out all of the unnecessary bloat, you would be left with BSDinit. There really is no need to go through all that trouble since BSDinit is already available. Stable, robust, sane, and works great on Unix or Linux.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
The OpenSSH security track record is excellent, almost perfect.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The Statue of Liberty (Liberty Enlightening the World; French: La Liberte eclairant le monde) is a colossal neoclassical sculpture on Liberty Island in the middle of New York Harbor, in Manhattan, New York City. The statue, designed by Frédéric Auguste Bartholdi and dedicated on October 28, 1886, was a gift to the United States from the people of France
(*): accents removed since slashdot seems unable to handle them
You seem to have missed the line at the bottom...
The link to OpenSSL is funny too ;-)
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
OpenOffice -> LibreOffice
...
?
OpenSSL -> LibreSSL
Will the next be
OpenSSH -> LibreSSH
OpenBSD -> LibreBSD
OpenStack -> LibreStack
Typefaces by their nature are designed to convey a specific emotions. It's the whole reason we don't simply convey written information in one fixed typeface; some are more appropriate than others given the situation.
Comic Sans in particular is designed to imitate comic book lettering. It's not particularly professional. In the wake of the OpenSSL bug, many people were questioning open source in general, saying (not rightfully, but saying nonetheless) that the Heartbleed bug was caused by a bunch of amateur volunteers. i.e. open source is not developed by professionals. Comic Sans doesn't exactly inspire confidence for people who now view the open source development model as dubious.
All Comic Sans conveys is "the writer of this is a jackass".
Fait accompli, apparently. :D
Well played, Theo et al.
A while ago... the common init startup procedures have been ignored by the Linux community and they developed their own Unix-incompatible way to start the system and even pollute many common applications with it so incompatibilties will be everywhere soon. And it keeps going on with KDBUS and so on..
Now when OpenBSD touches a central library it is ultimately bad for everyone, even when they don't destroy compatibility as much as it seems. Who uses VMS or pre-Windows-2000 systems today? Most of those people don't care about a new version of SSL anyway.
That one is easy: Just throw it away completely. Systemd is a major redesign of a major, critical Linux component.You would think that there is a very good, solid, compelling reason to do so. Apparently all they really have is "it boots faster". (And apparently id does not even do that in quite a few circumstances...)
My personal theory is that the NSA planned systemd as a project to sabotage Linux security (remember that Red Hat is primarily funded by the US military): Put an incompetent team with big egos in charge (Poettering and Sivers are certainly that), give them delusions of grandeur, make sure the BSD people ignore it by explicitly denying portability, and then just wait while the cretins produce a bloated, easy-to-exploit mess. (This "init-system" includes a freaking web-server! How stupid can you get?)
No need to place any backdoors, and all the countless vulnerabilities are genuine mistakes! Genius!
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I'm not gunna use no "liberal SSL", might as well just call it "socialist SSL" and get it over with.
They should call it "FREEDUMB:SSL" and make everybody happy.
Or at least "rePun SSL". Sorry, it's hard finding a use for that -ZL sound.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Why not call it egoSSL in honor of Theo DieRat!
They just come over as a bunch of complete, smug, self-absorbed wankers.
*golf clap*
Are you out of your mind?
OpenSSH is the only reason a machine of mine was rooted!
The OpenSSH security track record is excellent, almost perfect.
And yet OpenSSH also has its share of vulnerabilities:
http://www.cvedetails.com/vulnerability-list/vendor_id-7161/product_id-12081/Openssh-Openssh.html
Sure, none of those happened to be a total compromise, but that's basically luck. Consider:
Bugs happen in all software. :)
As a orthogonal point, weirdly the OpenSSL CVE score is only 5.0...
http://www.cvedetails.com/vulnerability-list/vendor_id-217/Openssl.html
They fix their own platform. You fix your platform.
OpenSSL can merge back whatever changes they want.
It's not like they can steal openssl login credentials and just fix all the code and make a new release for them.
Did you screw up the config? That will get you rooted...
Otherwise, please supply a CVE number for the vulnerability responsible.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Maybe gnuTSSlapp - Gnu TLS/SSL libre all privacy project . That sounds like it would fit the bill.
You did notice that "legacy" in the thing you quote? You can run OpenSSH with insecure settings or with protocol version 1.0. But if you use these you are supposed to look at the security trade-offs yourself. The thing is that it is not OpenSSH that is insecure here, it just allows you to shoot yourself in the foot after warning you.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
they are not even considering helping the original OpenSSL project (one that they have benefited greatly from in the past) and instead simply forked it in order to do only work that benefits themselves.
so youre suggesting that the maintainers of OpenSSL would have gladly allowed some new kids on the block come in and remove over 200,000 lines of stuff ? and that the new kids on the block are being lame for not trying to do so?
I think this move kind of strikes to the heart of the benefits of opensource projects. When someone decides they want to go in a different direction, they can. This direction is clearly (judging by the nearly 100,000 lines of code removed) different than the one the OpenSSL team is on..
The openbsd team supports over 20 platforms already. Deciding on on not supporting libressl on those 20 platforms before theyre even finished with the main bulk of the work seems pretty reasonable to me... and of course, it will be opensource.. you can go support other platforms if you want!
if you've got an axe to grind against Theo, and the openbsd team thats fine..... but at least you can be reasonable about this.. there is no evidence that the openbsd team has the same mentality as those in the openssl team had when it comes to making secure and correct code..
using funding to decide how/when theyll support other platforms doesnt relate in any way to the attitudes that caused the heartbleed bug... in fact, it might show that they wouldnt want to put a half-effort into something which they cannot use all of their resources on... which is a good thing.
The reason your machine was rooted is because it allowed root logins from the internet, and the root password was "password". OpenSSL was just the means.
Certainly not your paymasters in Redmond. They will only pay for shitlobbers like you.
Good job, you figured out why they chose that name. However, it's unrealistic that anyone would want to fork OpenSSH or OpenBSD.
The entire IT community is deep in love with "new, new, new". So we can new kernels with new features, new file systems, new browser features, new codecs. Did I tell you that you can now read your dog's neckband with Linux version 3.5.1.77-NEW ??
But only a few or no people make the effort to prove correctness of the kernel and the compilers and a basic web browser. That new-disease makes it incredibly easy for the Powers to find exploits. And that is exactly how they want it to be.
If we ever want "secure IT", we first need proven correct foundations like compilers, kernels, IP stacks. Will that ever happen ? I am sceptical.
They license the code so people can use it free of charge. Now they complain that people are using it free and not contributing back to the opensource community. Boohoo.
I don't think they care about how their font is interpreted.
I think this is more like - we're busy actually fixing code and not going to hire a team of web designers to produce a web 2.0 dynamic social-media-hooked-into website with a few links and a bit of text.
This. Seriously. People may not think that appearance is important, but it is. Comic Sans does not inspire confidence.
WEB HIPSTER DETECTED! ;)
And your post goes right along with the notion that Slashdot is filled with shitheads.
Yeah basically this. The sense of entitlement from people is quite astonishing. It's not good enough that they provide a free, amazingly secure OS, a free suite of SSH tools used by the entire world and are provideing a complete, open, audited implementation of SSL apparently.
No, they should do more, for free on their own time.
SJW n. One who posts facts.
How the fuck does this kind of trolling/tin-foil-hattery get to +5? The only "Interesting" thing about it is the apparent level of paranoia being experienced by gweihir. I mean, Red Hat as an NSA tool to Destroy Linux? Sure!
I get it, some folks hate systemd and everything Lennart does (and I'm not picking sides anymore), but the parent is just a smear job.
That codes looks "kind of nice". Still, using C++ could have made it more concise and therefore reduced the error potential. Mind you, using C++ does not guarantee that. Excellent engineers+experience+time+domain knowlegde plus C++ could possibly provide that.
Another way of tackling the "code complexity" (==lots of exploitable bugs, statistically speaking) would be to question the need for complex (== Asymmetric+symmetric, lots of options) protocols. The KISS principle certainly applies strongly to any security endeavour.
But lets just read this again:
the project has already removed 90,000 lines of C code and 150,000 lines of content.
The project further promises multi-OS support once they have proper funding and the right portability team in place
Remove current code for Windows and VMS support = check.
Wait for funding to code in Windows and VMS support back in = check
Pull the other one guys, honestly.
Anyone can remove code from someone elses project and make it more "optimized". The whole point is to either replace that with newer code, not ask for money to put it back in.
Your basically stealing the work of OpenSSL and using the current heartbleed as a goat to get funding for your project.
Maybe in 2000, I would have cared but no longer. OSS is very well established and is in plenty of cases the leading option.
Says the troll who actually likes X.org. Yeah, we get that you don't care. Just like you don't care that Stallman digested his own toejam. People like you aren't normal, nor the cream of the crop, so it's not surprising you place little value on appearance and design. It's a sad, dreary world you live in.
Are you retarded? For the trillionth time, OpenBSD had nothing to do with OpenSSL until they forked it? Learn how to fucking read.
Luckily though, they have a history of completing quality software to back up such an attitude. That's way better then the countless shitty projects with websites that push the very limits of jQuery and have beautiful CSS, but are only half-functional at best and riddled with security holes and have an obnoxious focus on spreading the word via facebook and a dozen other social sites.
For example, why can't we simply use a basic, symmetric protocol to access other computers of our organization. Have a 32 Character hex string as the key; written down in 3-octet groups. Set this key up once for your user by physically walking to the other box.
If you need to share a key with a remote site, have an admin once a year do a physical courier transport to the other sites for a secret OTP book which will be used to establish keys based on new requirements for the next year.
Too much work ? Not sexy/hipster enough ? Too secure for The Powers ?
Actually, they went out of their way to make the website look so bad and added a snarky, unprofessional comment about "web hipsters" to play that fact up. If they had spent less time on the site it would have actually looked better. This is completely disregarding the fact that making a decent looking site takes maybe half an hour. The website they created completely *distracts* from the project.
Instead we have yet another open source project run by myopic developers. You know, people who want to develop, and only want to develop. Ancillary things like project maintenance, management, and fund raising are those not fun, boring things that developers don't want to do.... and which got OpenSSL into trouble in the first place.
I wonder what, if any functionality they are removing.
To me, this just seems like they're trying to jump in quickly to take advantage of the OpenSSL FUD train to create a new "standard" that everyone will quickly switch to in a knee-jerk reaction, without really thinking the matter through, only to come out later and demand money from O/S vendors to re-integrate support for their O/S that was previously "deoptimized" from the OpenSSL code they're starting with...
Am I wrong?
The OpenSSL coders are paying a dear opportunity cost for doing their work.
Bullshit. They're obviously not doing this full time, or they would have caught and fixed the Heartbleed bug long ago. And if they ARE doing this full time, then they're compeltely incompetent at their job. ("You had one job!")
IMHO, if one thinks they can do better, then go for it.
That's exactly what they're doing. This is a hostile takeover of the project. :)
p.s. Now you can go get a real job and/or go make Fwp/P2W apps for iOS instead of pretending to maintain OpenSSL. :-D
...but it seems to be a key player in Project Atomic.
This seems to be Red Hat's analog of Solaris "Zones" which let you give root to someone you don't trust in an isolated sandbox on your system. It appears to go further than zones in that you can exchange these sandbox images, with all of their installed software, with other systems. This lets you virtualize without running multiple kernels, yeilding a tremendous savings of memory. The additional assertion is that 3rd party software sales will be of these complete sandbox images, not an RPM/tarfile.
I will have a bit of studying to do for Red Hat 7. These are compelling new features, seemingly well worth the initial bugs.
p.s. just don't pass debug to grub.
Yep, I couldn't have put it better. I don't think they understand how that landing page (and the comment you mention) will actually reduce the likelihood that visitors will trust their professionalism or donate to their efforts.
Koans and fables for the software engineer
The last across-the-board vulnerability in OpenSSH that I remember was before CVEs existed. It was circa 2000 or 2001. I remember because at the time I forgot my root password and used the exploit to break into my OpenBSD box.
Not long after that there was the zlib exploit, but by that point OpenSSH had privilege separation and it couldn't be used to root the machine, assuming privilege separation was enabled--many Linux distributions disabled it at the time, though.
However, the OpenSSH code is certainly not beautiful (as somebody else mentioned). I've extensively hacked on it. The code is actually quite old in many places, and all the feature enhancements by different people over the years have made it quite difficult to work with. It evolved with (and in many cases lead the development of) the SSH protocol, which means it had little benefit of hindsight to suggest how to structure the code. However, it's very well maintained, despite the ugly code, and that's what matters. OpenSSL, by contrast, is both ugly code and poorly maintained.
If you want pretty SSH code, I would checkout libssh2. Not sure about the quality, but it's definitely better structured.
The website they created completely *distracts* from the project.
No it doesn't. Now scamper along little web hipster.
So then no worse than you come off. Especially since they are busy doing important things not whining about fonts.
It's not like they can steal openssl login credentials and just fix all the code and make a new release for them.
Unless OpenSSL is still using their original code :)
Therefore, by the (faulty) logic you're using, you're just a cow with a keyboard - osu-neko (2604)
Just my point. The OpenSSH project has done its learning and reached a quite high level of quality 10 years or more ago. Ans as it does what it is supposed to, there is no need to add features, making it even more secure.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
My god, get a sense of humor and stop taking every moment of life so seriously.
There is an OpenBSD fork. It's called Bitrig.
WING ATTACK PLAN R
No reason to reinvent that.
I am very small, utmostly microscopic.
The last time I tried it, it didn't even recognize my USB keyboard or mouse so it was completely and entirely useless. Seems like they should focus their attention on making an OS that works on computers built within the past decade instead of forking other projects' code.
Maybe that's how it's so secure?
It started back in Team Fortress Classic
Let us hope that people now realize that attention needs to be given to critical components such as SSL. I also hope that in a year or ten, Theo de Raadt isn't in the same position as Robin Seggelmann - where some flaw slips in and kaboom. I try to contribute a few $ as a private user to open source projects. The big onus lies on companies who use open source to save millions in MS-costs, etc to contribute liberally to these projects. Thankfully a few great companies even allow people to work on these open source projects during their normal work time (on the clock).
it's like the sound of something going over your head - but you don't actually hear it.
(Other examples: ATM machine, PIN number, hot water heater)
WideOpenSSL!
If anyone's looking to grok it and potentially get involved, there's a fast OpenGrok available:
http://bxr.su/o/lib/libssl/src...
Is to create another OS alternative to replace the broken one? lol
I didn't understand what you were talking about until I checked the CSS's source. :)
They forgot to embed Comic Sans, so unless you installed it manually, you'll just see plain Sans.
They missed a trick tho, they could have had a few of these under the Other OS's title :)
Typefaces by their nature are designed to convey a specific emotions. It's the whole reason we don't simply convey written information in one fixed typeface; some are more appropriate than others given the situation.
It's not the whole reason: readability counts as well. Serifs work better at smaller font sizes in high resolution, helping us find contrasts and edges, while Helvetica style hard letters work well either at large sizes/high contrast where our eyes manage edge-finding by themselves, or at low resolutions where the serifs could not be of effect anyway. In between there is a large spectrum of what works best where: short messages? Long blocks of text? Printing technology used? Etc.
The part you mention is of course also a large part of most typefaces' mean of existence, but not the "whole reason". Comic Sans should in general be berated for its low readability as well; in this case it was apparent provocation though, so that somewhat makes it more OK :-) .
The fact that we're even talking about it proves the point. If they had used a respectable font, there would be no thread here talking about the terrible font choice and we'd instead be talking about the project.
What about PolarSSL, a professional alternative ?
OpenSSL.org claims the licenses are "BSD-style", but that's like putting a cow patty on your head and calling it a yarmulke. How is OpenBSD planning to get around that little hurdle?
suck on this thermometer: http://www.openbsdfoundation.o...
OpenBSD already has your LibreSystemd, it's called the BSD rc script system. it fucking works, bitches.
Already in progress:
http://www.google-melange.com/gsoc/project/details/google/gsoc2014/kremlin/5639274879778816
Because they could have not even added a font to the css saving even more time.
It took longer to make a shitty comic sans page, you fucking hipster dipshit.
They are too busy deleting and rewriting code, so they stopped to add comic sans to the page css file?
WTF?
Proving once again that BSD devs are clowns, dwarfed only by the shitheels responsible for Debian and all its bastard children.